CVE-2006-5741

{"id": "CVE-2006-5741", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-11-06T18:07:00.000", "references": [{"url": "http://secunia.com/advisories/22475", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/29918", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/29919", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/29920", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/449119/100/200/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/449739/100/100/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/451978/100/100/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/20602", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in AirMagnet Enterprise before 7.5 build 6307 allow remote attackers to inject arbitrary web script or HTML via (1) the 404 error page of the Smart Sensor Edge Sensor; (2) the user name for a failed logon, when displayed in the audit journals reviewing interface (/AirMagnetSensor/AMSensor.dll/XH) by the Smart Sensor Edge Sensor log viewer; and (3) an SSID of an AP, when displayed on an ACL page (/Amom/Amom.dll/BD) of the Enterprise Server Status Overview in the Enterprise Server Web interface."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en AirMagnet Enterprise 7.5 construccion 6307 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante (1) la p\u00e1gina de error 404 del sensor Smart Sensor Edge; (2) el nombre de usuario de un intento de validaci\u00f3n fallido, cuando se muestra en la interfaz de revisi\u00f3n de los informes de monitorizaci\u00f3n. (/AirMagnetSensor/AMSensor.dll/XH) desde el visor de registros Smart Sensor Edge Sensor; y (3) un SSID de un AP, cuando se muestra en una p\u00e1gina ACL (Amom/Amom.dll/BD) de Enterprise Server Status Overview en la interfaz Enterprise Server Web."}], "lastModified": "2018-10-17T21:44:21.677", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:airmagnet:enterprise:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "087E3F9C-86C4-4BDA-8946-0593F76FB85D"}], "operator": "OR"}]}], "vendorComments": [{"comment": "\n- Affected AirMagnet Builds: AirMagnet Enterprise 7.5 build 6289 and earlier.\n\n- Vulnerability Description: Intruders can execute a script in the Internet Explorer browser using symbols/script in the SSID generated by a fake access point. In the AirMagnet Enterprise system, such a script can be executed from the Sensor webpage or the AirWISE page in the AirMagnet Enterprise Console. This attack will not cause any damage to the AirMagnet Enterprise Server and no data will be lost or stolen. The intruder could potentially impact the performance of the machine running the Enterprise Console software. This is a known vulnerability in Internet Explorer and only works if users have enabled DirectX to execute scripts inside of Internet Explorer. \n\n- AirMagnet Solution: Listing SSIDs within quotes (\u201c \u201c) will fix the problem. Customers should also be encouraged to not allow DirectX scripts in IE.\n\n- Fix Availability: Patch currently available on MyAirMagnet. Customers should upgrade to the latest version available on MyAirMagnet. Customers running a version of AirMagnet older than 6.1 must upgrade to version 6.1 before upgrading to the current release. Customers can contact AirMagnet Support to obtain the 6.1 release. \n", "lastModified": "2007-08-17T00:00:00", "organization": "AirMagnet"}], "sourceIdentifier": "cve@mitre.org"}